| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: AviraAntivir.bat - in C:\Users\...\AppData\Local\ - CPU überlastet, Virus oder nicht?Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
13.06.2010, 13:34
| #1 |
| |  AviraAntivir.bat - in C:\Users\...\AppData\Local\ - CPU überlastet, Virus oder nicht? Liebe Leute, ich kann es nicht einschätzen, habe aber das Gefühl das ich mir einen Virus eingefangen habe. Sobald ein Prozess namens AviraAntivir.bat läuft, verlangsamt sich das System, die CPU Auslastung bleibt fast konstant auf 100% und das Internet ist auch nur noch mäßig schnell. Die Datei selbst, hat sich alleine in die Autostartliste eingetragen und in den Ordner /Benutzer/AppData/Local/Temp gelegt, obwohl ich kein Avira Antivir habe bzw. benutze. Wer sich die Datei mal anschauen möchte, sie ist hier hinterlegt von mir. h**p://musicube.bplaced.net/AviraAntivir.bat Die Suche bei Google brachte keine Ergebnisse, auch hier nicht. * CCleaner wurde erledigt. MSE meldet als vorläufiges Suchergebnis einen Virus, will aber erst am Ende genau melden um was es sich handelt. Geändert von dietzschi (13.06.2010 um 14:21 Uhr) |
|
13.06.2010, 13:48
| #2 |
| /// Malware-holic   | AviraAntivir.bat - in C:\Users\...\AppData\Local\ - CPU überlastet, Virus oder nicht? ootl:
__________________Systemscan mit OTL download otl: http://filepony.de/download-otl/ Doppelklick auf die OTL.exe (user von Windows 7 und Vista: Rechtsklick als Administrator ausführen) 1. Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output 2. Hake an "scan all users" 3. Unter "Extra Registry wähle: "Use Safelist" "LOP Check" "Purity Check" 4. Kopiere in die Textbox: netsvcs msconfig safebootminimal safebootnetwork activex drivers32 %ALLUSERSPROFILE%\Application Data\*. %ALLUSERSPROFILE%\Application Data\*.exe /s %APPDATA%\*. %APPDATA%\*.exe /s %SYSTEMDRIVE%\*.exe /md5start userinit.exe eventlog.dll scecli.dll netlogon.dll cngaudit.dll ws2ifsl.sys sceclt.dll ntelogon.dll logevent.dll iaStor.sys nvstor.sys atapi.sys IdeChnDr.sys viasraid.sys AGP440.sys vaxscsi.sys nvatabus.sys viamraid.sys nvata.sys nvgts.sys iastorv.sys ViPrt.sys eNetHook.dll ahcix86.sys KR10N.sys nvstor32.sys ahcix86s.sys /md5stop %systemroot%\system32\drivers\*.sys /lockedfiles %systemroot%\System32\config\*.sav %systemroot%\*. /mp /s %systemroot%\system32\*.dll /lockedfiles CREATERESTOREPOINT 5. Klicke "run Scan" 6. 2 reporte werden erstellt: OTL.Txt Extras.Txt eventuell musst du sie aufteilen. |
|
13.06.2010, 14:15
| #3 |
| | AviraAntivir.bat - in C:\Users\...\AppData\Local\ - CPU überlastet, Virus oder nicht? otl.txt
__________________OTL Logfile: Code:
ATTFilter OTL logfile created on: 13.06.2010 14:59:30 - Run 1 OTL by OldTimer - Version 3.2.6.0 Folder = C:\Downloads 64bit- Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation Internet Explorer (Version = 8.0.7600.16385) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 4,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 55,00% Memory free 7,00 Gb Paging File | 6,00 Gb Available in Paging File | 76,00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 233,54 Gb Total Space | 156,33 Gb Free Space | 66,94% Space Free | Partition Type: NTFS Drive D: | 12,69 Gb Total Space | 0,52 Gb Free Space | 4,09% Space Free | Partition Type: NTFS E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: DIETZSCHIS-PC Current User Name: Dietzschis Logged in as Administrator. Current Boot Mode: Normal Scan Mode: All users Include 64bit Scans Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Minimal ========== Processes (SafeList) ========== PRC - C:\Downloads\OTL.exe (OldTimer Tools) PRC - C:\Users\Dietzschis\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) PRC - C:\Program Files (x86)\Orbitdownloader\orbitdm.exe (Orbitdownloader.com) PRC - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) PRC - C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation) PRC - C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE (Microsoft Corporation) PRC - C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe (SweetIM Technologies Ltd.) PRC - C:\Program Files (x86)\Orbitdownloader\orbitnet.exe (Orbitdownloader.com) PRC - C:\Windows\SysWOW64\srvany.exe () ========== Modules (SafeList) ========== MOD - C:\Downloads\OTL.exe (OldTimer Tools) MOD - C:\Windows\SysWOW64\comdlg32.dll (Microsoft Corporation) MOD - C:\Windows\SysWOW64\msscript.ocx (Microsoft Corporation) MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_421189da2b7fabfc\comctl32.dll (Microsoft Corporation) ========== Win32 Services (SafeList) ========== SRV:64bit: - (MatSvc) -- C:\Program Files\Microsoft Fix it Center\Matsvc.exe (Microsoft Corporation) SRV:64bit: - (osppsvc) -- C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (Microsoft Corporation) SRV:64bit: - (MsMpSvc) -- c:\Program Files\Microsoft Security Essentials\MsMpEng.exe (Microsoft Corporation) SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD) SRV:64bit: - (WwanSvc) -- C:\Windows\SysNative\wwansvc.dll (Microsoft Corporation) SRV:64bit: - (WbioSrvc) -- C:\Windows\SysNative\wbiosrvc.dll (Microsoft Corporation) SRV:64bit: - (UmRdpService) -- C:\Windows\SysNative\umrdp.dll (Microsoft Corporation) SRV:64bit: - (Power) -- C:\Windows\SysNative\umpo.dll (Microsoft Corporation) SRV:64bit: - (Themes) -- C:\Windows\SysNative\themeservice.dll (Microsoft Corporation) SRV:64bit: - (sppuinotify) -- C:\Windows\SysNative\sppuinotify.dll (Microsoft Corporation) SRV:64bit: - (SensrSvc) -- C:\Windows\SysNative\sensrsvc.dll (Microsoft Corporation) SRV:64bit: - (PeerDistSvc) -- C:\Windows\SysNative\PeerDistSvc.dll (Microsoft Corporation) SRV:64bit: - (PNRPsvc) -- C:\Windows\SysNative\pnrpsvc.dll (Microsoft Corporation) SRV:64bit: - (p2pimsvc) -- C:\Windows\SysNative\pnrpsvc.dll (Microsoft Corporation) SRV:64bit: - (HomeGroupProvider) -- C:\Windows\SysNative\provsvc.dll (Microsoft Corporation) SRV:64bit: - (RpcEptMapper) -- C:\Windows\SysNative\RpcEpMap.dll (Microsoft Corporation) SRV:64bit: - (PNRPAutoReg) -- C:\Windows\SysNative\pnrpauto.dll (Microsoft Corporation) SRV:64bit: - (HomeGroupListener) -- C:\Windows\SysNative\ListSvc.dll (Microsoft Corporation) SRV:64bit: - (FontCache) -- C:\Windows\SysNative\FntCache.dll (Microsoft Corporation) SRV:64bit: - (Dhcp) -- C:\Windows\SysNative\dhcpcore.dll (Microsoft Corporation) SRV:64bit: - (defragsvc) -- C:\Windows\SysNative\defragsvc.dll (Microsoft Corporation) SRV:64bit: - (CscService) -- C:\Windows\SysNative\cscsvc.dll (Microsoft Corporation) SRV:64bit: - (bthserv) -- C:\Windows\SysNative\bthserv.dll (Microsoft Corporation) SRV:64bit: - (BDESVC) -- C:\Windows\SysNative\bdesvc.dll (Microsoft Corporation) SRV:64bit: - (AxInstSV) -- C:\Windows\SysNative\AxInstSv.dll (Microsoft Corporation) SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation) SRV:64bit: - (AppIDSvc) -- C:\Windows\SysNative\appidsvc.dll (Microsoft Corporation) SRV:64bit: - (wbengine) -- C:\Windows\SysNative\wbengine.exe (Microsoft Corporation) SRV:64bit: - (sppsvc) -- C:\Windows\SysNative\sppsvc.exe (Microsoft Corporation) SRV:64bit: - (Fax) -- C:\Windows\SysNative\FXSSVC.exe (Microsoft Corporation) SRV - (Apple Mobile Device) -- C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) SRV - (Microsoft SharePoint Workspace Audit Service) -- C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE (Microsoft Corporation) SRV - (VSS) -- C:\Windows\Vss [2009.07.14 05:20:14 | 000,000,000 | ---D | M] SRV - (MSDTC) -- C:\Windows\SysWOW64\Msdtc [2009.07.14 05:20:14 | 000,000,000 | ---D | M] SRV - (HomeGroupProvider) -- C:\Windows\SysWOW64\provsvc.dll (Microsoft Corporation) SRV - (Dhcp) -- C:\Windows\SysWOW64\dhcpcore.dll (Microsoft Corporation) SRV - (vds) -- C:\Windows\SysWOW64\wbem\vds.mof () SRV - (clr_optimization_v2.0.50727_64) -- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe (Microsoft Corporation) SRV - (KMService) -- C:\Windows\SysWOW64\srvany.exe () ========== Driver Services (SafeList) ========== DRV:64bit: - (RDPDISPM) -- C:\Windows\SysNative\drivers\rdpdispm.sys (Microsoft Corporation) DRV:64bit: - (clwvd) -- C:\Windows\SysNative\drivers\clwvd.sys (Windows (R) Win 7 DDK provider) DRV:64bit: - (KSecPkg) -- C:\Windows\SysNative\drivers\ksecpkg.sys (Microsoft Corporation) DRV:64bit: - (TFsExDisk) -- C:\Windows\SysNative\drivers\TFsExDisk.sys (Teruten Inc) DRV:64bit: - (USBAAPL64) -- C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.) DRV:64bit: - (athr) -- C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.) DRV:64bit: - (fvevol) -- C:\Windows\SysNative\drivers\fvevol.sys (Microsoft Corporation) DRV:64bit: - (L1E) -- C:\Windows\SysNative\drivers\L1E62x64.sys (Atheros Communications, Inc.) DRV:64bit: - (atikmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.) DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices) DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices) DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.) DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation) DRV:64bit: - (hwpolicy) -- C:\Windows\SysNative\drivers\hwpolicy.sys (Microsoft Corporation) DRV:64bit: - (FsDepends) -- C:\Windows\SysNative\drivers\fsdepends.sys (Microsoft Corporation) DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company) DRV:64bit: - (WIMMount) -- C:\Windows\SysNative\drivers\wimmount.sys (Microsoft Corporation) DRV:64bit: - (vhdmp) -- C:\Windows\SysNative\drivers\vhdmp.sys (Microsoft Corporation) DRV:64bit: - (vmbus) -- C:\Windows\SysNative\drivers\vmbus.sys (Microsoft Corporation) DRV:64bit: - (storflt) -- C:\Windows\SysNative\drivers\vmstorfl.sys (Microsoft Corporation) DRV:64bit: - (vdrvroot) -- C:\Windows\SysNative\drivers\vdrvroot.sys (Microsoft Corporation) DRV:64bit: - (storvsc) -- C:\Windows\SysNative\drivers\storvsc.sys (Microsoft Corporation) DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology) DRV:64bit: - (rdyboost) -- C:\Windows\SysNative\drivers\rdyboost.sys (Microsoft Corporation) DRV:64bit: - (pcw) -- C:\Windows\SysNative\drivers\pcw.sys (Microsoft Corporation) DRV:64bit: - (CNG) -- C:\Windows\SysNative\drivers\cng.sys (Microsoft Corporation) DRV:64bit: - (rdpbus) -- C:\Windows\SysNative\drivers\rdpbus.sys (Microsoft Corporation) DRV:64bit: - (RDPREFMP) -- C:\Windows\SysNative\drivers\RDPREFMP.sys (Microsoft Corporation) DRV:64bit: - (RasAgileVpn) WAN Miniport (IKEv2) -- C:\Windows\SysNative\drivers\agilevpn.sys (Microsoft Corporation) DRV:64bit: - (WfpLwf) -- C:\Windows\SysNative\drivers\wfplwf.sys (Microsoft Corporation) DRV:64bit: - (NdisCap) -- C:\Windows\SysNative\drivers\ndiscap.sys (Microsoft Corporation) DRV:64bit: - (vwififlt) -- C:\Windows\SysNative\drivers\vwififlt.sys (Microsoft Corporation) DRV:64bit: - (vwifibus) -- C:\Windows\SysNative\drivers\vwifibus.sys (Microsoft Corporation) DRV:64bit: - (1394ohci) -- C:\Windows\SysNative\drivers\1394ohci.sys (Microsoft Corporation) DRV:64bit: - (HdAudAddService) -- C:\Windows\SysNative\drivers\HdAudio.sys (Microsoft Corporation) DRV:64bit: - (usbvideo) USB-Videogerät (WDM) -- C:\Windows\SysNative\drivers\usbvideo.sys (Microsoft Corporation) DRV:64bit: - (UmPass) -- C:\Windows\SysNative\drivers\umpass.sys (Microsoft Corporation) DRV:64bit: - (WinUsb) -- C:\Windows\SysNative\drivers\winusb.sys (Microsoft Corporation) DRV:64bit: - (mshidkmdf) -- C:\Windows\SysNative\drivers\mshidkmdf.sys (Microsoft Corporation) DRV:64bit: - (WudfPf) -- C:\Windows\SysNative\drivers\WUDFPf.sys (Microsoft Corporation) DRV:64bit: - (MTConfig) -- C:\Windows\SysNative\drivers\MTConfig.sys (Microsoft Corporation) DRV:64bit: - (CompositeBus) -- C:\Windows\SysNative\drivers\CompositeBus.sys (Microsoft Corporation) DRV:64bit: - (Beep) -- C:\Windows\SysNative\drivers\beep.sys (Microsoft Corporation) DRV:64bit: - (AppID) -- C:\Windows\SysNative\drivers\appid.sys (Microsoft Corporation) DRV:64bit: - (scfilter) -- C:\Windows\SysNative\drivers\scfilter.sys (Microsoft Corporation) DRV:64bit: - (s3cap) -- C:\Windows\SysNative\drivers\vms3cap.sys (Microsoft Corporation) DRV:64bit: - (VMBusHID) -- C:\Windows\SysNative\drivers\VMBusHID.sys (Microsoft Corporation) DRV:64bit: - (discache) -- C:\Windows\SysNative\drivers\discache.sys (Microsoft Corporation) DRV:64bit: - (HidBatt) -- C:\Windows\SysNative\drivers\hidbatt.sys (Microsoft Corporation) DRV:64bit: - (CmBatt) -- C:\Windows\SysNative\drivers\CmBatt.sys (Microsoft Corporation) DRV:64bit: - (AcpiPmi) -- C:\Windows\SysNative\drivers\acpipmi.sys (Microsoft Corporation) DRV:64bit: - (CSC) -- C:\Windows\SysNative\drivers\csc.sys (Microsoft Corporation) DRV:64bit: - (AmdPPM) -- C:\Windows\SysNative\drivers\amdppm.sys (Microsoft Corporation) DRV:64bit: - (AgereSoftModem) -- C:\Windows\SysNative\drivers\agrsm64.sys (LSI Corp) DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation) DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation) DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation) DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.) DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.) DRV:64bit: - (winbondcir) -- C:\Windows\SysNative\drivers\winbondcir.sys (Winbond Electronics Corporation) DRV - (CSC) -- C:\Windows\CSC [2010.03.22 00:53:39 | 000,000,000 | ---D | M] DRV - (TFsExDisk) -- C:\Windows\SysWOW64\drivers\TFsExDisk.Sys (Teruten Inc) DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation) DRV - (WinUsb) -- C:\Windows\SysWOW64\winusb.dll (Microsoft Corporation) DRV - (NetBIOS) -- C:\Windows\SysWOW64\netbios.dll (Microsoft Corporation) DRV - (mpsdrv) -- C:\Windows\SysWOW64\wbem\mpsdrv.mof () DRV - (Tcpip) -- C:\Windows\SysWOW64\wbem\tcpip.mof () DRV - (StarOpen) -- C:\Windows\SysWOW64\drivers\StarOpen.sys () ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-2288765413-1222552687-3727849114-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKU\S-1-5-21-2288765413-1222552687-3727849114-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKU\S-1-5-21-2288765413-1222552687-3727849114-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = C0 9D BE 20 8C E8 CA 01 [binary data] IE - HKU\S-1-5-21-2288765413-1222552687-3727849114-1000\..\URLSearchHook: {EEE6C35D-6118-11DC-9C72-001320C79847} - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgHelper.dll (SweetIM Technologies Ltd.) IE - HKU\S-1-5-21-2288765413-1222552687-3727849114-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-2288765413-1222552687-3727849114-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..extensions.enabledItems: {53A03D43-5363-4669-8190-99061B2DEBA5}:1.3.7 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20 FF - prefs.js..extensions.enabledItems: {35379F86-8CCB-4724-AE33-4278DE266C70}:1.0.5 FF - HKLM\software\mozilla\Mozilla Firefox 3.6.2pre\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2010.04.05 16:57:16 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.2pre\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2010.05.13 20:52:35 | 000,000,000 | ---D | M] [2010.03.29 15:43:26 | 000,000,000 | ---D | M] -- C:\Users\Dietzschis\AppData\Roaming\mozilla\Extensions [2010.03.25 21:55:49 | 000,000,000 | ---D | M] -- C:\Users\Dietzschis\AppData\Roaming\mozilla\Extensions\songbird@songbirdnest.com [2010.06.11 17:38:08 | 000,000,000 | ---D | M] -- C:\Users\Dietzschis\AppData\Roaming\mozilla\Firefox\Profiles\cve00i05.default\extensions [2010.03.29 15:44:51 | 000,000,000 | ---D | M] (ScrapBook) -- C:\Users\Dietzschis\AppData\Roaming\mozilla\Firefox\Profiles\cve00i05.default\extensions\{53A03D43-5363-4669-8190-99061B2DEBA5} [2010.05.13 20:52:37 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Mozilla Firefox\extensions [2010.05.13 20:52:37 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} [2010.05.13 20:52:20 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll [2010.03.02 17:00:02 | 000,075,208 | ---- | M] (Foxit Software Company) -- C:\Program Files (x86)\Mozilla Firefox\plugins\npFoxitReaderPlugin.dll [2010.03.16 20:28:04 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\amazondotcom-de.xml [2010.03.16 20:28:04 | 000,002,344 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\eBay-de.xml [2010.03.16 20:28:04 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\leo_ende_de.xml [2010.03.16 20:28:04 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\wikipedia-de.xml [2010.03.16 20:28:04 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2:64bit: - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found. O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) O2 - BHO: (SweetIM Toolbar Helper) - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.) O3 - HKLM\..\Toolbar: (SweetIM Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.) O3 - HKU\S-1-5-21-2288765413-1222552687-3727849114-1000\..\Toolbar\WebBrowser: (SweetIM Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.) O4:64bit: - HKLM..\Run: [MSSE] c:\Program Files\Microsoft Security Essentials\msseces.exe (Microsoft Corporation) O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Programme\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor) O4 - HKLM..\Run: [BCSSync] C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe (Microsoft Corporation) O4 - HKLM..\Run: [boinctray] C:\Program Files (x86)\BOINC\boinctray.exe (Space Sciences Laboratory) O4 - HKLM..\Run: [SweetIM] C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe (SweetIM Technologies Ltd.) O4 - HKLM..\Run: [UpdatePDRShortCut] C:\Program Files (x86)\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe (CyberLink Corp.) O4 - HKLM..\Run: [YouCam Mirage] C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe (CyberLink) O4 - HKLM..\Run: [YouCam Tray] C:\Program Files (x86)\CyberLink\YouCam\YouCam.exe (CyberLink Corp.) O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-21-2288765413-1222552687-3727849114-1000..\Run: [boincmgr] C:\Program Files (x86)\BOINC\boincmgr.exe (World Community Grid) O4 - HKU\S-1-5-21-2288765413-1222552687-3727849114-1000..\Run: [ICQ] C:\Program Files (x86)\ICQ7.1\ICQ.exe (ICQ, LLC.) O4 - HKU\S-1-5-21-2288765413-1222552687-3727849114-1000..\Run: [msnmsgr] C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe (Microsoft Corporation) O4 - HKU\S-1-5-21-2288765413-1222552687-3727849114-1000..\Run: [OfficeSyncProcess] C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE (Microsoft Corporation) O4 - HKU\S-1-5-21-2288765413-1222552687-3727849114-1000..\Run: [RESTART_STICKY_NOTES] C:\Windows\SysWow64\StikyNot.exe File not found O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\SysWow64\mctadmin.exe File not found O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\SysWow64\mctadmin.exe File not found O4 - Startup: C:\Users\Dietzschis\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk = C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O8:64bit: - Extra context menu item: An OneNote s&enden - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation) O8 - Extra context menu item: An OneNote s&enden - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation) O9:64bit: - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9:64bit: - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9:64bit: - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O9:64bit: - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: ICQ7.1 - {71BFC818-0CED-42D6-9C87-5142918957EE} - C:\Program Files (x86)\ICQ7.1\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ7.1 - {71BFC818-0CED-42D6-9C87-5142918957EE} - C:\Program Files (x86)\ICQ7.1\ICQ.exe (ICQ, LLC.) O9 - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.) O13 - gopher Prefix: missing O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) O16 - DPF: {A3E21079-7F41-4125-9EBB-FD44CFCC0AC1} https://www.mesh.com/0.9.4014.40/TSWeb.cab (WLCTSCControl Class) O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files (x86)\Windows Live\Mail\mailcomm.dll (Microsoft Corporation) O18:64bit: - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysWow64\SystemPropertiesPerformance.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found. O28:64bit: - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) O30:64bit: - LSA: Security Packages - (pku2u) - C:\Windows\SysNative\pku2u.dll (Microsoft Corporation) O30 - LSA: Security Packages - (pku2u) - C:\Windows\SysWow64\pku2u.dll (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2010.06.06 20:53:10 | 000,000,053 | -H-- | M] () - D:\autorun.inf -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* NetSvcs:64bit: Ias - C:\Windows\SysNative\ias [2009.07.14 05:20:14 | 000,000,000 | ---D | M] NetSvcs:64bit: Irmon - C:\Windows\SysNative\irmon.dll (Microsoft Corporation) NetSvcs:64bit: Wmi - C:\Windows\SysNative\wmi.dll (Microsoft Corporation) NetSvcs:64bit: Themes - C:\Windows\SysNative\themeservice.dll (Microsoft Corporation) NetSvcs:64bit: BDESVC - C:\Windows\SysNative\bdesvc.dll (Microsoft Corporation) NetSvcs:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation) NetSvcs: Ias - C:\Windows\SysWOW64\ias.dll (Microsoft Corporation) NetSvcs: Wmi - C:\Windows\SysWOW64\wmi.dll (Microsoft Corporation) SafeBootMin:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation) SafeBootMin:64bit: Base - Driver Group SafeBootMin:64bit: Boot Bus Extender - Driver Group SafeBootMin:64bit: Boot file system - Driver Group SafeBootMin:64bit: File system - Driver Group SafeBootMin:64bit: Filter - Driver Group SafeBootMin:64bit: HelpSvc - Service SafeBootMin:64bit: MsMpSvc - c:\Program Files\Microsoft Security Essentials\MsMpEng.exe (Microsoft Corporation) SafeBootMin:64bit: PCI Configuration - Driver Group SafeBootMin:64bit: PNP Filter - Driver Group SafeBootMin:64bit: Power - C:\Windows\SysNative\umpo.dll (Microsoft Corporation) SafeBootMin:64bit: Primary disk - Driver Group SafeBootMin:64bit: RpcEptMapper - C:\Windows\SysNative\RpcEpMap.dll (Microsoft Corporation) SafeBootMin:64bit: sacsvr - Service SafeBootMin:64bit: SCSI Class - Driver Group SafeBootMin:64bit: System Bus Extender - Driver Group SafeBootMin:64bit: vmms - Service SafeBootMin:64bit: WudfPf - C:\Windows\SysNative\drivers\WUDFPf.sys (Microsoft Corporation) SafeBootMin:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootMin:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootMin:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootMin:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootMin:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootMin:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootMin:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootMin:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootMin:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootMin:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootMin:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootMin:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootMin:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootMin:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootMin:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootMin:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootMin:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices SafeBootMin: Base - Driver Group SafeBootMin: Boot Bus Extender - Driver Group SafeBootMin: Boot file system - Driver Group SafeBootMin: File system - Driver Group SafeBootMin: Filter - Driver Group SafeBootMin: HelpSvc - Service SafeBootMin: PCI Configuration - Driver Group SafeBootMin: PNP Filter - Driver Group SafeBootMin: Primary disk - Driver Group SafeBootMin: sacsvr - Service SafeBootMin: SCSI Class - Driver Group SafeBootMin: System Bus Extender - Driver Group SafeBootMin: VDS - C:\Windows\SysWOW64\wbem\vds.mof () SafeBootMin: vmms - Service SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices SafeBootNet:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation) SafeBootNet:64bit: Base - Driver Group SafeBootNet:64bit: Boot Bus Extender - Driver Group SafeBootNet:64bit: Boot file system - Driver Group SafeBootNet:64bit: Dhcp - C:\Windows\SysNative\dhcpcore.dll (Microsoft Corporation) SafeBootNet:64bit: File system - Driver Group SafeBootNet:64bit: Filter - Driver Group SafeBootNet:64bit: HelpSvc - Service SafeBootNet:64bit: Messenger - Service SafeBootNet:64bit: MsMpSvc - c:\Program Files\Microsoft Security Essentials\MsMpEng.exe (Microsoft Corporation) SafeBootNet:64bit: NDIS Wrapper - Driver Group SafeBootNet:64bit: ndiscap - C:\Windows\SysNative\drivers\ndiscap.sys (Microsoft Corporation) SafeBootNet:64bit: NetBIOSGroup - Driver Group SafeBootNet:64bit: NetDDEGroup - Driver Group SafeBootNet:64bit: Network - Driver Group SafeBootNet:64bit: NetworkProvider - Driver Group SafeBootNet:64bit: PCI Configuration - Driver Group SafeBootNet:64bit: PNP Filter - Driver Group SafeBootNet:64bit: PNP_TDI - Driver Group SafeBootNet:64bit: Power - C:\Windows\SysNative\umpo.dll (Microsoft Corporation) SafeBootNet:64bit: Primary disk - Driver Group SafeBootNet:64bit: rdsessmgr - Service SafeBootNet:64bit: RpcEptMapper - C:\Windows\SysNative\RpcEpMap.dll (Microsoft Corporation) SafeBootNet:64bit: sacsvr - Service SafeBootNet:64bit: SCSI Class - Driver Group SafeBootNet:64bit: Streams Drivers - Driver Group SafeBootNet:64bit: System Bus Extender - Driver Group SafeBootNet:64bit: TDI - Driver Group SafeBootNet:64bit: vmms - Service SafeBootNet:64bit: WudfPf - C:\Windows\SysNative\drivers\WUDFPf.sys (Microsoft Corporation) SafeBootNet:64bit: WudfUsbccidDriver - Driver SafeBootNet:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootNet:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootNet:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootNet:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootNet:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootNet:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootNet:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootNet:64bit: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net SafeBootNet:64bit: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient SafeBootNet:64bit: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService SafeBootNet:64bit: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans SafeBootNet:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootNet:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootNet:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootNet:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootNet:64bit: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers SafeBootNet:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootNet:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootNet:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootNet:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootNet:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootNet:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices SafeBootNet: Base - Driver Group SafeBootNet: Boot Bus Extender - Driver Group SafeBootNet: Boot file system - Driver Group SafeBootNet: Dhcp - C:\Windows\SysWOW64\dhcpcore.dll (Microsoft Corporation) SafeBootNet: File system - Driver Group SafeBootNet: Filter - Driver Group SafeBootNet: HelpSvc - Service SafeBootNet: Messenger - Service SafeBootNet: MPSDrv - C:\Windows\SysWOW64\wbem\mpsdrv.mof () SafeBootNet: NDIS Wrapper - Driver Group SafeBootNet: NetBIOS - C:\Windows\SysWOW64\netbios.dll (Microsoft Corporation) SafeBootNet: NetBIOSGroup - Driver Group SafeBootNet: NetDDEGroup - Driver Group SafeBootNet: Network - Driver Group SafeBootNet: NetworkProvider - Driver Group SafeBootNet: PCI Configuration - Driver Group SafeBootNet: PNP Filter - Driver Group SafeBootNet: PNP_TDI - Driver Group SafeBootNet: Primary disk - Driver Group SafeBootNet: rdsessmgr - Service SafeBootNet: sacsvr - Service SafeBootNet: SCSI Class - Driver Group SafeBootNet: Streams Drivers - Driver Group SafeBootNet: System Bus Extender - Driver Group SafeBootNet: Tcpip - C:\Windows\SysWOW64\wbem\tcpip.mof () SafeBootNet: TDI - Driver Group SafeBootNet: VDS - C:\Windows\SysWOW64\wbem\vds.mof () SafeBootNet: vmms - Service SafeBootNet: WudfUsbccidDriver - Driver SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0 ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun) ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0 ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP Drivers32:64bit: aux - C:\Windows\SysNative\wdmaud.drv (Microsoft Corporation) Drivers32:64bit: aux1 - C:\Windows\SysNative\wdmaud.drv (Microsoft Corporation) Drivers32:64bit: midi - C:\Windows\SysNative\wdmaud.drv (Microsoft Corporation) Drivers32:64bit: midi1 - C:\Windows\SysNative\wdmaud.drv (Microsoft Corporation) Drivers32:64bit: midimapper - C:\Windows\SysNative\midimap.dll (Microsoft Corporation) Drivers32:64bit: mixer - C:\Windows\SysNative\wdmaud.drv (Microsoft Corporation) Drivers32:64bit: mixer1 - C:\Windows\SysNative\wdmaud.drv (Microsoft Corporation) Drivers32:64bit: msacm.imaadpcm - C:\Windows\SysNative\imaadp32.acm (Microsoft Corporation) Drivers32:64bit: msacm.l3acm - C:\Windows\SysNative\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS) Drivers32:64bit: msacm.msadpcm - C:\Windows\SysNative\msadp32.acm (Microsoft Corporation) Drivers32:64bit: msacm.msg711 - C:\Windows\SysNative\msg711.acm (Microsoft Corporation) Drivers32:64bit: msacm.msgsm610 - C:\Windows\SysNative\msgsm32.acm (Microsoft Corporation) Drivers32:64bit: MSVideo8 - C:\Windows\SysNative\vfwwdm32.dll (Microsoft Corporation) Drivers32:64bit: vidc.i420 - C:\Windows\SysNative\iyuv_32.dll (Microsoft Corporation) Drivers32:64bit: VIDC.IYUV - C:\Windows\SysNative\iyuv_32.dll (Microsoft Corporation) Drivers32:64bit: vidc.mrle - C:\Windows\SysNative\msrle32.dll (Microsoft Corporation) Drivers32:64bit: vidc.msvc - C:\Windows\SysNative\msvidc32.dll (Microsoft Corporation) Drivers32:64bit: VIDC.UYVY - C:\Windows\SysNative\msyuv.dll (Microsoft Corporation) Drivers32:64bit: VIDC.YUY2 - C:\Windows\SysNative\msyuv.dll (Microsoft Corporation) Drivers32:64bit: VIDC.YVU9 - C:\Windows\SysNative\tsbyuv.dll (Microsoft Corporation) Drivers32:64bit: VIDC.YVYU - C:\Windows\SysNative\msyuv.dll (Microsoft Corporation) Drivers32:64bit: wave - C:\Windows\SysNative\wdmaud.drv (Microsoft Corporation) Drivers32:64bit: wave1 - C:\Windows\SysNative\wdmaud.drv (Microsoft Corporation) Drivers32:64bit: wavemapper - C:\Windows\SysNative\msacm32.drv (Microsoft Corporation) Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS) Drivers32: msacm.siren - C:\Windows\SysWow64\sirenacm.dll (Microsoft Corporation) Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.) CREATERESTOREPOINT Restore point Set: OTL Restore Point ========== Files/Folders - Created Within 30 Days ========== [2010.06.13 14:45:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\CCleaner [2010.06.13 00:34:44 | 000,000,000 | ---D | C] -- C:\Users\Dietzschis\Documents\OneNote-Notizbücher [2010.06.12 22:32:12 | 000,000,000 | ---D | C] -- C:\games [2010.06.12 21:26:53 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Synchronization Services [2010.06.12 21:26:50 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\DESIGNER [2010.06.12 21:26:05 | 000,000,000 | ---D | C] -- C:\Windows\PCHEALTH [2010.06.12 21:26:05 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft.NET [2010.06.12 21:26:05 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Sync Framework [2010.06.12 21:21:51 | 000,000,000 | -HSD | C] -- C:\Config.Msi [2010.06.12 21:17:33 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Visual Studio 8 [2010.06.12 21:16:13 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Analysis Services [2010.06.12 19:37:14 | 000,000,000 | ---D | C] -- C:\Users\Dietzschis\Documents\CyberLink [2010.06.12 19:33:25 | 000,000,000 | ---D | C] -- C:\ProgramData\SmartSound Software Inc [2010.06.12 19:33:24 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\SmartSound Software [2010.06.12 17:55:41 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Ravensburger [2010.06.12 17:55:28 | 000,328,704 | ---- | C] (InstallShield Software Corporation ) -- C:\Windows\IsUn0407.exe [2010.06.09 20:21:48 | 000,084,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\asycfilt.dll [2010.06.09 20:21:48 | 000,067,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\asycfilt.dll [2010.06.09 20:19:31 | 001,026,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mstime.dll [2010.06.09 20:19:30 | 001,192,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wininet.dll [2010.06.09 20:19:30 | 000,606,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mstime.dll [2010.06.09 20:19:28 | 000,977,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wininet.dll [2010.06.09 20:19:28 | 000,445,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iedkcs32.dll [2010.06.09 20:19:28 | 000,381,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iedkcs32.dll [2010.06.09 20:19:28 | 000,082,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeedsbs.dll [2010.06.09 20:19:27 | 000,064,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeedsbs.dll [2010.06.09 20:19:26 | 000,064,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jsproxy.dll [2010.06.09 20:19:26 | 000,048,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jsproxy.dll [2010.06.09 20:16:58 | 000,366,080 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysNative\atmfd.dll [2010.06.09 20:16:58 | 000,293,888 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\atmfd.dll [2010.06.09 20:16:57 | 000,046,080 | ---- | C] (Adobe Systems) -- C:\Windows\SysNative\atmlib.dll [2010.06.09 20:16:57 | 000,034,304 | ---- | C] (Adobe Systems) -- C:\Windows\SysWow64\atmlib.dll [2010.06.08 19:26:44 | 000,000,000 | ---D | C] -- C:\Users\Dietzschis\AppData\Roaming\GrabPro [2010.05.30 23:34:50 | 000,000,000 | ---D | C] -- C:\ubuntu [2010.05.25 14:21:58 | 000,000,000 | ---D | C] -- C:\Downloads [2010.05.25 14:21:33 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Orbitdownloader [2010.05.25 14:21:32 | 000,000,000 | ---D | C] -- C:\Users\Dietzschis\AppData\Roaming\Orbit [2010.05.24 21:33:57 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\CyberLink [2010.05.24 14:10:41 | 000,000,000 | ---D | C] -- C:\Users\Dietzschis\AppData\Local\Zattoo [2010.05.24 14:09:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Zattoo4 [2010.05.24 10:46:44 | 000,000,000 | ---D | C] -- C:\Users\Dietzschis\Documents\Ausscheid [2010.05.21 14:29:38 | 000,000,000 | ---D | C] -- C:\Users\Dietzschis\Documents\regio.online [2010.05.20 20:01:41 | 000,000,000 | ---D | C] -- C:\Users\Dietzschis\DocumentsAlternateUrlAds [2010.05.15 21:03:30 | 000,000,000 | ---D | C] -- C:\Users\Dietzschis\AppData\Local\FixItCenter [2010.05.15 21:01:04 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft Fix it Center [2010.05.15 21:01:04 | 000,000,000 | ---D | C] -- C:\Windows\MATS [2010.05.14 18:52:28 | 000,000,000 | ---D | C] -- C:\Users\Dietzschis\AppData\Roaming\MAGIX [2010.05.14 18:52:27 | 000,000,000 | ---D | C] -- C:\ProgramData\MAGIX [2010.05.14 18:52:23 | 000,044,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msxml4a.dll [2010.05.14 18:51:51 | 000,000,000 | ---D | C] -- C:\Users\Dietzschis\Documents\Xara Web Designer [2010.05.14 18:51:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Xara [2010.05.14 18:51:37 | 000,700,416 | ---- | C] (MAGIX AG) -- C:\Windows\SysWow64\mgxoschk.dll [2010.05.14 18:51:37 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\MAGIX [1 C:\Users\Dietzschis\Documents\*.tmp files -> C:\Users\Dietzschis\Documents\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2010.06.13 15:02:17 | 003,407,872 | -HS- | M] () -- C:\Users\Dietzschis\NTUSER.DAT [2010.06.13 14:53:14 | 000,045,582 | ---- | M] () -- C:\Users\Dietzschis\Documents\cc_20100613_145308.reg [2010.06.13 14:45:31 | 000,001,849 | ---- | M] () -- C:\Users\Dietzschis\Desktop\CCleaner.lnk [2010.06.13 14:41:00 | 000,001,138 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2288765413-1222552687-3727849114-1000UA.job [2010.06.13 14:41:00 | 000,001,086 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2288765413-1222552687-3727849114-1000Core.job [2010.06.13 14:12:50 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2010.06.13 12:17:23 | 000,014,016 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2010.06.13 12:17:23 | 000,014,016 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2010.06.13 12:12:45 | 000,002,807 | ---- | M] () -- C:\Users\Dietzschis\Desktop\CyberLink PowerDirector.lnk [2010.06.13 12:11:36 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT [2010.06.13 12:11:19 | 000,470,888 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2010.06.13 12:10:54 | 3018,608,640 | -HS- | M] () -- C:\hiberfil.sys [2010.06.13 00:39:58 | 003,718,960 | -H-- | M] () -- C:\Users\Dietzschis\AppData\Local\IconCache.db [2010.06.13 00:39:54 | 000,007,625 | ---- | M] () -- C:\Users\Dietzschis\AppData\Local\Resmon.ResmonCfg [2010.06.13 00:36:25 | 000,139,440 | ---- | M] () -- C:\Users\Dietzschis\AppData\Local\GDIPFONTCACHEV1.DAT [2010.06.13 00:34:47 | 000,001,304 | ---- | M] () -- C:\Users\Dietzschis\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk [2010.06.12 22:32:14 | 000,000,745 | ---- | M] () -- C:\Users\Dietzschis\Desktop\Icy Tower.lnk [2010.06.12 21:39:52 | 000,000,478 | ---- | M] () -- C:\Windows\win.ini [2010.06.12 18:01:55 | 000,002,066 | ---- | M] () -- C:\Users\Public\Desktop\Fünf Freunde 3 auf Entführerjagd.lnk [2010.06.12 17:52:48 | 000,252,131 | ---- | M] () -- C:\Users\Dietzschis\Documents\annesegehrs.docx [2010.06.12 12:34:20 | 000,100,280 | ---- | M] () -- C:\Users\Dietzschis\Documents\DAS OBDACH.pptx [2010.06.12 11:02:46 | 001,472,002 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2010.06.12 11:02:46 | 000,643,866 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2010.06.12 11:02:46 | 000,607,190 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2010.06.12 11:02:46 | 000,126,394 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2010.06.12 11:02:46 | 000,103,568 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2010.06.12 01:47:37 | 001,092,058 | ---- | M] () -- C:\Users\Dietzschis\Documents\annesegehrs.pdf [2010.06.11 16:42:31 | 000,000,162 | -H-- | M] () -- C:\Users\Dietzschis\Documents\~$nesegehrs.docx [2010.06.09 21:32:10 | 000,012,094 | ---- | M] () -- C:\Users\Dietzschis\Documents\Das Obdach - Inhaltsangabe.docx [2010.06.09 19:57:17 | 000,002,388 | ---- | M] () -- C:\Users\Dietzschis\Desktop\Google Chrome.lnk [2010.06.08 19:05:54 | 000,326,559 | ---- | M] () -- C:\Users\Dietzschis\Documents\Flyer_genehmigt.pdf [2010.06.08 19:05:42 | 000,128,000 | ---- | M] () -- C:\Users\Dietzschis\Documents\Flyer.doc [2010.06.07 15:40:56 | 000,030,720 | ---- | M] () -- C:\Users\Dietzschis\Documents\Protokoll [07.06.10].doc [2010.06.06 21:00:17 | 000,257,055 | ---- | M] () -- C:\Users\Dietzschis\Documents\Lebenslauf.pdf [2010.06.06 20:59:53 | 000,262,711 | ---- | M] () -- C:\Users\Dietzschis\Documents\Bewerbung sovello.pdf [2010.06.06 20:59:38 | 000,012,154 | ---- | M] () -- C:\Users\Dietzschis\Documents\Bewerbung sovello.docx [2010.06.06 19:33:35 | 000,013,320 | ---- | M] () -- C:\Users\Dietzschis\Documents\Lebenslaufalternativ.docx [2010.06.06 19:30:45 | 000,127,488 | ---- | M] () -- C:\Users\Dietzschis\Documents\flyermithinweisen.doc [2010.06.05 19:47:04 | 000,013,309 | ---- | M] () -- C:\Users\Dietzschis\Documents\Lebenslauf.docx [2010.06.05 18:55:26 | 000,094,224 | ---- | M] () -- C:\Users\Dietzschis\Documents\Eric Dietzsch.pdf [2010.06.03 18:32:34 | 000,387,407 | ---- | M] () -- C:\Users\Dietzschis\Documents\Flyerneu.pdf [2010.06.03 18:27:14 | 000,345,566 | ---- | M] () -- C:\Users\Dietzschis\Documents\Hey Hey.pdf [2010.06.02 15:20:33 | 000,027,186 | ---- | M] () -- C:\Users\Dietzschis\Documents\Flyer.docx [2010.06.01 19:09:12 | 000,302,490 | ---- | M] () -- C:\Users\Dietzschis\Documents\flyer.pdf [2010.05.30 23:35:42 | 000,088,813 | ---- | M] () -- C:\wubildr [2010.05.30 23:35:42 | 000,008,192 | ---- | M] () -- C:\wubildr.mbr [2010.05.30 19:27:02 | 000,003,072 | -H-- | M] () -- C:\Users\Dietzschis\Documents\photothumb.db [2010.05.27 09:24:13 | 000,034,304 | ---- | M] (Adobe Systems) -- C:\Windows\SysWow64\atmlib.dll [2010.05.27 08:34:09 | 000,046,080 | ---- | M] (Adobe Systems) -- C:\Windows\SysNative\atmlib.dll [2010.05.27 06:11:32 | 000,366,080 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysNative\atmfd.dll [2010.05.27 05:49:37 | 000,293,888 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\atmfd.dll [2010.05.25 16:52:52 | 000,524,288 | -HS- | M] () -- C:\Users\Dietzschis\NTUSER.DAT{1d9bd803-6802-11df-80cd-001e68f92c37}.TMContainer00000000000000000002.regtrans-ms [2010.05.25 16:52:52 | 000,524,288 | -HS- | M] () -- C:\Users\Dietzschis\NTUSER.DAT{1d9bd803-6802-11df-80cd-001e68f92c37}.TMContainer00000000000000000001.regtrans-ms [2010.05.25 16:52:52 | 000,065,536 | -HS- | M] () -- C:\Users\Dietzschis\NTUSER.DAT{1d9bd803-6802-11df-80cd-001e68f92c37}.TM.blf [2010.05.25 14:21:38 | 000,001,015 | ---- | M] () -- C:\Users\Dietzschis\Desktop\Orbit.lnk [2010.05.24 21:35:20 | 000,001,223 | ---- | M] () -- C:\Users\Public\Desktop\CyberLink YouCam.lnk [2010.05.24 14:10:42 | 000,017,408 | ---- | M] () -- C:\Users\Dietzschis\AppData\Local\WebpageIcons.db [2010.05.24 14:09:22 | 000,001,832 | ---- | M] () -- C:\Users\Dietzschis\Desktop\Zattoo.lnk [2010.05.21 14:42:22 | 000,013,022 | ---- | M] () -- C:\Users\Dietzschis\Desktop\Essay.docx [2010.05.21 14:41:35 | 000,037,495 | ---- | M] () -- C:\Users\Dietzschis\Documents\lwlNOW.docx [2010.05.21 07:52:30 | 001,192,960 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wininet.dll [2010.05.21 07:47:27 | 000,064,512 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\jsproxy.dll [2010.05.21 07:18:06 | 000,977,920 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\wininet.dll [2010.05.21 07:14:50 | 000,048,128 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\jsproxy.dll [2010.05.18 17:39:36 | 000,061,838 | ---- | M] () -- C:\Users\Dietzschis\Documents\J A H R E S P L A N.docx [2010.05.18 17:38:49 | 000,523,812 | ---- | M] () -- C:\Users\Dietzschis\Documents\J A H R E S P L A N.pdf [2010.05.17 20:45:07 | 000,010,977 | ---- | M] () -- C:\Users\Dietzschis\Documents\Sehr geehrtes NDR 1 Radio MV Team.docx [2010.05.17 16:20:38 | 000,027,648 | ---- | M] () -- C:\Users\Dietzschis\Desktop\Artikel.doc [2010.05.15 21:01:05 | 000,000,931 | ---- | M] () -- C:\Users\Public\Desktop\Microsoft Fix*it Center.lnk [2010.05.14 18:52:23 | 000,001,148 | ---- | M] () -- C:\Users\Public\Desktop\Xara Web Designer.lnk [2010.05.14 18:51:38 | 000,006,211 | ---- | M] () -- C:\Windows\mgxoschk.ini [1 C:\Users\Dietzschis\Documents\*.tmp files -> C:\Users\Dietzschis\Documents\*.tmp -> ] ========== Files Created - No Company Name ========== [2010.06.13 14:53:11 | 000,045,582 | ---- | C] () -- C:\Users\Dietzschis\Documents\cc_20100613_145308.reg [2010.06.13 14:45:31 | 000,001,849 | ---- | C] () -- C:\Users\Dietzschis\Desktop\CCleaner.lnk [2010.06.13 00:39:54 | 000,007,625 | ---- | C] () -- C:\Users\Dietzschis\AppData\Local\Resmon.ResmonCfg [2010.06.13 00:34:47 | 000,001,304 | ---- | C] () -- C:\Users\Dietzschis\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk [2010.06.12 22:40:33 | 000,008,192 | ---- | C] () -- C:\Windows\SysWow64\srvany.exe [2010.06.12 22:32:14 | 000,000,745 | ---- | C] () -- C:\Users\Dietzschis\Desktop\Icy Tower.lnk [2010.06.12 19:32:56 | 000,002,807 | ---- | C] () -- C:\Users\Dietzschis\Desktop\CyberLink PowerDirector.lnk [2010.06.12 18:01:55 | 000,002,066 | ---- | C] () -- C:\Users\Public\Desktop\Fünf Freunde 3 auf Entführerjagd.lnk [2010.06.12 12:34:19 | 000,100,280 | ---- | C] () -- C:\Users\Dietzschis\Documents\DAS OBDACH.pptx [2010.06.12 01:47:35 | 001,092,058 | ---- | C] () -- C:\Users\Dietzschis\Documents\annesegehrs.pdf [2010.06.11 16:42:31 | 000,000,162 | -H-- | C] () -- C:\Users\Dietzschis\Documents\~$nesegehrs.docx [2010.06.09 21:32:08 | 000,012,094 | ---- | C] () -- C:\Users\Dietzschis\Documents\Das Obdach - Inhaltsangabe.docx [2010.06.08 19:05:53 | 000,326,559 | ---- | C] () -- C:\Users\Dietzschis\Documents\Flyer_genehmigt.pdf [2010.06.08 15:09:34 | 000,252,131 | ---- | C] () -- C:\Users\Dietzschis\Documents\annesegehrs.docx [2010.06.07 15:40:55 | 000,030,720 | ---- | C] () -- C:\Users\Dietzschis\Documents\Protokoll [07.06.10].doc [2010.06.06 21:00:15 | 000,257,055 | ---- | C] () -- C:\Users\Dietzschis\Documents\Lebenslauf.pdf [2010.06.06 20:58:25 | 000,262,711 | ---- | C] () -- C:\Users\Dietzschis\Documents\Bewerbung sovello.pdf [2010.06.06 19:33:35 | 000,013,320 | ---- | C] () -- C:\Users\Dietzschis\Documents\Lebenslaufalternativ.docx [2010.06.06 19:30:44 | 000,127,488 | ---- | C] () -- C:\Users\Dietzschis\Documents\flyermithinweisen.doc [2010.06.05 19:43:07 | 000,013,309 | ---- | C] () -- C:\Users\Dietzschis\Documents\Lebenslauf.docx [2010.06.05 19:31:28 | 000,012,154 | ---- | C] () -- C:\Users\Dietzschis\Documents\Bewerbung sovello.docx [2010.06.05 18:55:25 | 000,094,224 | ---- | C] () -- C:\Users\Dietzschis\Documents\Eric Dietzsch.pdf [2010.06.03 18:32:33 | 000,387,407 | ---- | C] () -- C:\Users\Dietzschis\Documents\Flyerneu.pdf [2010.06.03 18:31:52 | 000,128,000 | ---- | C] () -- C:\Users\Dietzschis\Documents\Flyer.doc [2010.06.03 18:27:12 | 000,345,566 | ---- | C] () -- C:\Users\Dietzschis\Documents\Hey Hey.pdf [2010.06.01 19:17:19 | 000,027,186 | ---- | C] () -- C:\Users\Dietzschis\Documents\Flyer.docx [2010.06.01 19:09:11 | 000,302,490 | ---- | C] () -- C:\Users\Dietzschis\Documents\flyer.pdf [2010.05.30 23:35:42 | 000,088,813 | ---- | C] () -- C:\wubildr [2010.05.30 23:35:42 | 000,008,192 | ---- | C] () -- C:\wubildr.mbr [2010.05.30 19:26:54 | 000,003,072 | -H-- | C] () -- C:\Users\Dietzschis\Documents\photothumb.db [2010.05.25 15:34:22 | 000,524,288 | -HS- | C] () -- C:\Users\Dietzschis\NTUSER.DAT{1d9bd803-6802-11df-80cd-001e68f92c37}.TMContainer00000000000000000002.regtrans-ms [2010.05.25 15:34:21 | 000,524,288 | -HS- | C] () -- C:\Users\Dietzschis\NTUSER.DAT{1d9bd803-6802-11df-80cd-001e68f92c37}.TMContainer00000000000000000001.regtrans-ms [2010.05.25 15:34:20 | 000,065,536 | -HS- | C] () -- C:\Users\Dietzschis\NTUSER.DAT{1d9bd803-6802-11df-80cd-001e68f92c37}.TM.blf [2010.05.25 14:21:38 | 000,001,015 | ---- | C] () -- C:\Users\Dietzschis\Desktop\Orbit.lnk [2010.05.24 21:35:20 | 000,001,223 | ---- | C] () -- C:\Users\Public\Desktop\CyberLink YouCam.lnk [2010.05.24 14:10:41 | 000,017,408 | ---- | C] () -- C:\Users\Dietzschis\AppData\Local\WebpageIcons.db [2010.05.24 14:09:22 | 000,001,832 | ---- | C] () -- C:\Users\Dietzschis\Desktop\Zattoo.lnk [2010.05.21 14:41:35 | 000,037,495 | ---- | C] () -- C:\Users\Dietzschis\Documents\lwlNOW.docx [2010.05.18 17:39:34 | 000,061,838 | ---- | C] () -- C:\Users\Dietzschis\Documents\J A H R E S P L A N.docx [2010.05.18 17:38:47 | 000,523,812 | ---- | C] () -- C:\Users\Dietzschis\Documents\J A H R E S P L A N.pdf [2010.05.17 18:54:57 | 000,013,022 | ---- | C] () -- C:\Users\Dietzschis\Desktop\Essay.docx [2010.05.17 16:20:37 | 000,027,648 | ---- | C] () -- C:\Users\Dietzschis\Desktop\Artikel.doc [2010.05.15 21:01:05 | 000,000,931 | ---- | C] () -- C:\Users\Public\Desktop\Microsoft Fix*it Center.lnk [2010.05.14 18:52:23 | 000,001,148 | ---- | C] () -- C:\Users\Public\Desktop\Xara Web Designer.lnk [2010.05.14 18:51:50 | 000,120,200 | ---- | C] () -- C:\Windows\SysWow64\DLLDEV32i.dll [2010.05.14 18:51:37 | 000,006,211 | ---- | C] () -- C:\Windows\mgxoschk.ini [2010.04.03 13:58:00 | 000,005,632 | ---- | C] () -- C:\Windows\SysWow64\drivers\StarOpen.sys [2009.07.14 01:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll [2009.07.13 23:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll ========== LOP Check ========== [2010.06.13 14:57:07 | 000,000,000 | ---D | M] -- C:\Users\Dietzschis\AppData\Roaming\FileZilla [2010.06.08 19:26:44 | 000,000,000 | ---D | M] -- C:\Users\Dietzschis\AppData\Roaming\GrabPro [2010.06.13 12:17:38 | 000,000,000 | ---D | M] -- C:\Users\Dietzschis\AppData\Roaming\ICQ [2010.03.29 18:02:14 | 000,000,000 | ---D | M] -- C:\Users\Dietzschis\AppData\Roaming\KompoZer [2010.05.14 18:52:28 | 000,000,000 | ---D | M] -- C:\Users\Dietzschis\AppData\Roaming\MAGIX [2010.05.08 17:55:53 | 000,000,000 | ---D | M] -- C:\Users\Dietzschis\AppData\Roaming\Nvu [2010.06.13 14:57:31 | 000,000,000 | ---D | M] -- C:\Users\Dietzschis\AppData\Roaming\Orbit [2010.04.03 15:35:54 | 000,000,000 | ---D | M] -- C:\Users\Dietzschis\AppData\Roaming\Samsung [2010.03.25 21:55:46 | 000,000,000 | ---D | M] -- C:\Users\Dietzschis\AppData\Roaming\Songbird2 [2010.05.26 17:42:24 | 000,000,000 | ---D | M] -- C:\Users\Dietzschis\AppData\Roaming\VSO [2009.07.14 07:08:49 | 000,011,718 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== ========== Custom Scans ========== < %ALLUSERSPROFILE%\Application Data\*. > < %ALLUSERSPROFILE%\Application Data\*.exe /s > < %APPDATA%\*. > [2010.03.22 16:06:45 | 000,000,000 | ---D | M] -- C:\Users\Dietzschis\AppData\Roaming\Adobe [2010.03.25 22:08:02 | 000,000,000 | ---D | M] -- C:\Users\Dietzschis\AppData\Roaming\Apple Computer [2010.06.12 19:37:08 | 000,000,000 | ---D | M] -- C:\Users\Dietzschis\AppData\Roaming\CyberLink [2010.06.13 14:57:07 | 000,000,000 | ---D | M] -- C:\Users\Dietzschis\AppData\Roaming\FileZilla [2010.06.08 19:26:44 | 000,000,000 | ---D | M] -- C:\Users\Dietzschis\AppData\Roaming\GrabPro [2010.06.13 12:17:38 | 000,000,000 | ---D | M] -- C:\Users\Dietzschis\AppData\Roaming\ICQ [2010.03.22 01:03:15 | 000,000,000 | ---D | M] -- C:\Users\Dietzschis\AppData\Roaming\Identities [2010.03.29 18:02:14 | 000,000,000 | ---D | M] -- C:\Users\Dietzschis\AppData\Roaming\KompoZer [2010.03.22 16:06:45 | 000,000,000 | ---D | M] -- C:\Users\Dietzschis\AppData\Roaming\Macromedia [2010.05.14 18:52:28 | 000,000,000 | ---D | M] -- C:\Users\Dietzschis\AppData\Roaming\MAGIX [2009.07.14 20:18:19 | 000,000,000 | ---D | M] -- C:\Users\Dietzschis\AppData\Roaming\Media Center Programs [2010.06.13 00:34:46 | 000,000,000 | --SD | M] -- C:\Users\Dietzschis\AppData\Roaming\Microsoft [2010.03.29 15:43:14 | 000,000,000 | ---D | M] -- C:\Users\Dietzschis\AppData\Roaming\Mozilla [2010.05.08 17:55:53 | 000,000,000 | ---D | M] -- C:\Users\Dietzschis\AppData\Roaming\Nvu [2010.06.13 14:57:31 | 000,000,000 | ---D | M] -- C:\Users\Dietzschis\AppData\Roaming\Orbit [2010.04.03 15:35:54 | 000,000,000 | ---D | M] -- C:\Users\Dietzschis\AppData\Roaming\Samsung [2010.06.13 12:47:44 | 000,000,000 | ---D | M] -- C:\Users\Dietzschis\AppData\Roaming\Skype [2010.06.13 12:12:59 | 000,000,000 | ---D | M] -- C:\Users\Dietzschis\AppData\Roaming\skypePM [2010.03.25 21:55:46 | 000,000,000 | ---D | M] -- C:\Users\Dietzschis\AppData\Roaming\Songbird2 [2010.05.26 17:42:24 | 000,000,000 | ---D | M] -- C:\Users\Dietzschis\AppData\Roaming\VSO < %APPDATA%\*.exe /s > [2010.03.27 22:08:24 | 000,003,262 | R--- | M] () -- C:\Users\Dietzschis\AppData\Roaming\Microsoft\Installer\{E7394983-3869-46F4-A117-EB148F104D79}\ARPPRODUCTICON.exe [2010.03.27 22:08:24 | 000,003,262 | R--- | M] () -- C:\Users\Dietzschis\AppData\Roaming\Microsoft\Installer\{E7394983-3869-46F4-A117-EB148F104D79}\BOINCManagerShortcut_F8D63239C34C43E18FC7841149A9E4C1.exe < %SYSTEMDRIVE%\*.exe > < MD5 for: AGP440.SYS > [2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysWow64\DriverStore\FileRepository\machine.inf_amd64_neutral_9e6bb86c3b39a3e9\AGP440.sys [2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys < MD5 for: ATAPI.SYS > [2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysWow64\DriverStore\FileRepository\mshdc.inf_amd64_neutral_a69a58a4286f0b22\atapi.sys [2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys < MD5 for: CNGAUDIT.DLL > [2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll [2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll [2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll [2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll < MD5 for: EVENTLOG.DLL > [2008.06.06 14:03:52 | 000,007,216 | ---- | M] () MD5=C2A279A458A06DE2C83D842AA042B5A8 -- C:\Program Files (x86)\CyberLink\PowerDirector\EventLog.dll < MD5 for: IASTORV.SYS > [2009.07.14 03:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\SysWow64\DriverStore\FileRepository\iastorv.inf_amd64_neutral_18cccb83b34e1453\iaStorV.sys [2009.07.14 03:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys < MD5 for: NETLOGON.DLL > [2009.07.14 03:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll [2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\SysWOW64\netlogon.dll [2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\SysWOW64\netlogon.dll [2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll < MD5 for: NVSTOR.SYS > [2009.07.14 03:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\SysWow64\DriverStore\FileRepository\nvraid.inf_amd64_neutral_5bde3fe2945bce9e\nvstor.sys [2009.07.14 03:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys < MD5 for: SCECLI.DLL > [2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\SysWOW64\scecli.dll [2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\SysWOW64\scecli.dll [2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll [2009.07.14 03:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll < MD5 for: USERINIT.EXE > [2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\SysWOW64\userinit.exe [2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\SysWOW64\userinit.exe [2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe [2009.07.14 03:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe < MD5 for: WS2IFSL.SYS > [2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys < %systemroot%\system32\drivers\*.sys /lockedfiles > < %systemroot%\System32\config\*.sav > < %systemroot%\*. /mp /s > < %systemroot%\system32\*.dll /lockedfiles > ========== Alternate Data Streams ========== @Alternate Data Stream - 123 bytes -> C:\ProgramData\Temp:78CE0B72 < End of report > |
|
13.06.2010, 14:16
| #4 |
| | AviraAntivir.bat - in C:\Users\...\AppData\Local\ - CPU überlastet, Virus oder nicht? extra.txt OTL EXTRAS Logfile: Code:
ATTFilter OTL Extras logfile created on: 13.06.2010 14:59:30 - Run 1
OTL by OldTimer - Version 3.2.6.0 Folder = C:\Downloads
64bit- Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
4,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 55,00% Memory free
7,00 Gb Paging File | 6,00 Gb Available in Paging File | 76,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 233,54 Gb Total Space | 156,33 Gb Free Space | 66,94% Space Free | Partition Type: NTFS
Drive D: | 12,69 Gb Total Space | 0,52 Gb Free Space | 4,09% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Computer Name: DIETZSCHIS-PC
Current User Name: Dietzschis
Logged in as Administrator.
Current Boot Mode: Normal
Scan Mode: All users
Include 64bit Scans
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
========== Extra Registry (SafeList) ==========
========== File Associations ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
[HKEY_USERS\S-1-5-21-2288765413-1222552687-3727849114-1000\SOFTWARE\Classes\<extension>]
.html [@ = htmlfile] -- Reg Error: Key error. File not found
========== Shell Spawning ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %* File not found
cmdfile [open] -- "%1" %* File not found
comfile [open] -- "%1" %* File not found
exefile [open] -- "%1" %* File not found
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- "C:\Program Files (x86)\Microsoft Office\Office14\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Program Files (x86)\Microsoft Office\Office14\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %* File not found
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1" File not found
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S File not found
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 File not found
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- "C:\Program Files (x86)\Microsoft Office\Office14\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Program Files (x86)\Microsoft Office\Office14\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files (x86)\Orbitdownloader\orbitdm.exe" = C:\Program Files (x86)\Orbitdownloader\orbitdm.exe:*:Enabled:Orbit -- (Orbitdownloader.com)
"C:\Program Files (x86)\Orbitdownloader\orbitnet.exe" = C:\Program Files (x86)\Orbitdownloader\orbitnet.exe:*:Enabled:Orbit -- (Orbitdownloader.com)
"C:\Program Files (x86)\Orbitdownloader\orbitdm.exe" = C:\Program Files (x86)\Orbitdownloader\orbitdm.exe:*:Enabled:Orbit -- (Orbitdownloader.com)
"C:\Program Files (x86)\Orbitdownloader\orbitnet.exe" = C:\Program Files (x86)\Orbitdownloader\orbitnet.exe:*:Enabled:Orbit -- (Orbitdownloader.com)
========== HKEY_LOCAL_MACHINE Uninstall List ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{23170F69-40C1-2702-0465-000001000000}" = 7-Zip 4.65 (x64 edition)
"{404BB1FF-A84F-432F-B77B-301E88E8D1C7}" = Apple Mobile Device Support
"{84ED5482-CFB0-4DD9-BF18-489FFDACD18A}" = Microsoft Antimalware Service DE-DE Language Pack
"{90140000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2010
"{90140000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2010
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{95C9C76F-ECF3-40FA-94F8-5DDFB6BAF40D}" = Microsoft Security Essentials
"{96D5EB02-DE18-4DCD-A713-929B4461CA8D}" = iTunes
"{B67C01B3-8502-4BE7-AEAB-BBDE910AD3EE}" = Microsoft Web Platform Installer 2.0
"{B7588D45-AFDC-4C93-9E2E-A100F3554B64}" = Microsoft Fix it Center
"{C19D4D8F-4433-4F6D-9F0C-79589FD0B973}" = Bonjour
"{E590FD1C-E8C6-4D2E-8CA9-77B403F7EE01}" = Microsoft Antimalware
"Microsoft Security Essentials" = Microsoft Security Essentials
"SAMSUNG Mobile Composite Device" = SAMSUNG Mobile Composite Device Software
"SAMSUNG Mobile Modem" = SAMSUNG Mobile Modem Driver Set
"Samsung Mobile phone USB driver Drive" = Samsung Mobile phone USB driver Drive Software
"SAMSUNG Mobile USB Modem" = SAMSUNG Mobile USB Modem Software
"SAMSUNG Mobile USB Modem 1.0" = SAMSUNG Mobile USB Modem 1.0 Software
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam
"{1E299D2F-A7BA-457A-BECF-35AC55E4BD74}" = SweetIM Toolbar for Internet Explorer 3.6
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java(TM) 6 Update 20
"{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}" = QuickTime
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{3EE51BAD-9916-49C7-90BA-3D500B031E0C}_is1" = VSO Image Resizer 3.0.1.76
"{3EEF7D9E-9650-4335-A41B-A693CB57A496}" = Foxit Reader
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A7FDA4D-F4D7-4A49-934A-066D59A43C7E}" = SmartSound Quicktracks Plugin
"{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent
"{553255F3-78FD-40F1-A6F8-6882140265FE}" = Apple Application Support
"{586509F0-350D-48B5-B763-9CC2F8D96C4C}" = Windows Live Sync
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{71BFC818-0CED-42D6-9C87-5142918957EE}" = ICQ7.1
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{850C7BD3-9F3F-46AD-9396-E7985B38C55E}" = Windows Live Fotogalerie
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8E5233E1-7495-44FB-8DEB-4BE906D59619}" = Junk Mail filter update
"{90140000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2010
"{90140000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2010
"{90140000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010
"{90140000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010
"{90140000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2010
"{90140000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010
"{90140000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2010
"{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010
"{90140000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010
"{90140000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2010
"{90140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010
"{90140000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010
"{90140000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2010
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A7496F46-78AE-4DB2-BCF5-95F210FA6F96}" = Windows Live Movie Maker
"{A7E19604-93AF-4611-8C9F-CE509C2B286E}_is1" = VDownloader 2.6
"{AED2DD42-9853-407E-A6BC-8A1D6B715909}" = Windows Live Messenger
"{B3783869-5D14-4838-A042-910DF816D070}" = Xara3D6
"{C4D738F7-996A-4C81-B8FA-C4E26D767E41}" = Windows Live Mail
"{CAFA57E8-8927-4912-AFCF-B0AA3837E989}" = Windows Live Essentials
"{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = CyberLink PowerDirector
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D2041A37-5FEC-49F0-AE5C-3F2FFDFAA4F4}" = Windows Live Call
"{E7394983-3869-46F4-A117-EB148F104D79}" = World Community Grid - BOINC for Windows
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F81415D2-CEC9-4F96-9ABA-B2CC5382A930}" = SweetIM for Messenger 3.0
"{FB26A501-6BA6-459B-89AA-9736730752FB}" = VoiceOver Kit
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"CCleaner" = CCleaner
"FileZilla Client" = FileZilla Client 3.2.7.1
"Free Studio_is1" = Free Studio version 4.3
"Fünf Freunde 3" = Fünf Freunde 3
"Icy Tower v1.4_is1" = Icy Tower v1.4
"InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam
"InstallShield_{4A7FDA4D-F4D7-4A49-934A-066D59A43C7E}" = SmartSound Quicktracks Plugin
"InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = CyberLink PowerDirector
"KompoZer_is1" = KompoZer 0.77
"Mozilla Firefox (3.6.2pre)" = Mozilla Firefox (3.6.2pre)
"Nvu_is1" = Nvu 1.0
"Office14.PROPLUS" = Microsoft Office Professional Plus 2010
"PhotoScape" = PhotoScape
"PHP Coder_is1" = PHP Coder Release R2 Final PreRelease 3
"Show.kit_is1" = Show.kit
"Uninstall_is1" = Uninstall 1.0.0.1
"WinLiveSuite_Wave3" = Windows Live Essentials
"Wubi" = Ubuntu Netbook
"Xara Web Designer UK" = Xara Web Designer
"Zattoo4" = Zattoo4 4.0.5
========== HKEY_USERS Uninstall List ==========
[HKEY_USERS\S-1-5-21-2288765413-1222552687-3727849114-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome
========== Last 10 Event Log Errors ==========
[ Application Events ]
Error - 12.06.2010 06:34:27 | Computer Name = Dietzschis-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 3089
Error - 12.06.2010 11:51:10 | Computer Name = Dietzschis-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
Error - 12.06.2010 11:51:11 | Computer Name = Dietzschis-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 19006709
Error - 12.06.2010 11:51:11 | Computer Name = Dietzschis-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 19006709
Error - 12.06.2010 11:51:17 | Computer Name = Dietzschis-PC | Source = Google Update | ID = 20
Description =
Error - 12.06.2010 12:07:56 | Computer Name = Dietzschis-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: Fünf Freunde 3.exe, Version: 0.0.0.0,
Zeitstempel: 0x39e34375 Name des fehlerhaften Moduls: Fünf Freunde 3.exe, Version:
0.0.0.0, Zeitstempel: 0x39e34375 Ausnahmecode: 0xc0000005 Fehleroffset: 0x000b13d3
ID
des fehlerhaften Prozesses: 0xd9c Startzeit der fehlerhaften Anwendung: 0x01cb0a48b3aaa5f1
Pfad
der fehlerhaften Anwendung: C:\Program Files (x86)\Ravensburger\Fünf Freunde 3\Fünf
Freunde 3.exe Pfad des fehlerhaften Moduls: C:\Program Files (x86)\Ravensburger\Fünf
Freunde 3\Fünf Freunde 3.exe Berichtskennung: a90b8927-763c-11df-90bc-001e68f92c37
Error - 12.06.2010 12:41:06 | Computer Name = Dietzschis-PC | Source = Google Update | ID = 20
Description =
Error - 12.06.2010 12:42:39 | Computer Name = Dietzschis-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: Fünf Freunde 3.exe, Version: 0.0.0.0,
Zeitstempel: 0x39e34375 Name des fehlerhaften Moduls: Fünf Freunde 3.exe, Version:
0.0.0.0, Zeitstempel: 0x39e34375 Ausnahmecode: 0xc0000005 Fehleroffset: 0x000b13d3
ID
des fehlerhaften Prozesses: 0x94c Startzeit der fehlerhaften Anwendung: 0x01cb0a4ce286178d
Pfad
der fehlerhaften Anwendung: C:\Program Files (x86)\Ravensburger\Fünf Freunde 3\Fünf
Freunde 3.exe Pfad des fehlerhaften Moduls: C:\Program Files (x86)\Ravensburger\Fünf
Freunde 3\Fünf Freunde 3.exe Berichtskennung: 82d0320e-7641-11df-90bc-001e68f92c37
Error - 12.06.2010 12:46:25 | Computer Name = Dietzschis-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: Fünf Freunde 3.exe, Version: 0.0.0.0,
Zeitstempel: 0x39e34375 Name des fehlerhaften Moduls: Fünf Freunde 3.exe, Version:
0.0.0.0, Zeitstempel: 0x39e34375 Ausnahmecode: 0xc0000005 Fehleroffset: 0x000b13d3
ID
des fehlerhaften Prozesses: 0xf28 Startzeit der fehlerhaften Anwendung: 0x01cb0a4e49240579
Pfad
der fehlerhaften Anwendung: C:\Program Files (x86)\Ravensburger\Fünf Freunde 3\Fünf
Freunde 3.exe Pfad des fehlerhaften Moduls: C:\Program Files (x86)\Ravensburger\Fünf
Freunde 3\Fünf Freunde 3.exe Berichtskennung: 09752ced-7642-11df-90bc-001e68f92c37
Error - 12.06.2010 13:32:56 | Computer Name = Dietzschis-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files
(x86)\CyberLink\PowerDirector\PDR8.exe.Manifest". Die abhängige Assemblierung "Microsoft.VC90.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8""
konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm
"sxstrace.exe".
[ Media Center Events ]
Error - 19.05.2010 15:53:10 | Computer Name = Dietzschis-PC | Source = MCUpdate | ID = 0
Description = 21:53:08 - Fehler beim Herstellen der Internetverbindung. 21:53:08
- Serververbindung konnte nicht hergestellt werden..
Error - 19.05.2010 22:52:05 | Computer Name = Dietzschis-PC | Source = MCUpdate | ID = 0
Description = 04:52:05 - Fehler beim Herstellen der Internetverbindung. 04:52:05
- Serververbindung konnte nicht hergestellt werden..
Error - 20.05.2010 08:55:18 | Computer Name = Dietzschis-PC | Source = MCUpdate | ID = 0
Description = 04:52:10 - Fehler beim Herstellen der Internetverbindung. 04:52:10
- Serververbindung konnte nicht hergestellt werden..
Error - 20.05.2010 13:42:48 | Computer Name = Dietzschis-PC | Source = MCUpdate | ID = 0
Description = 19:42:47 - Fehler beim Herstellen der Internetverbindung. 19:42:48
- Serververbindung konnte nicht hergestellt werden..
Error - 20.05.2010 13:42:55 | Computer Name = Dietzschis-PC | Source = MCUpdate | ID = 0
Description = 19:42:53 - Fehler beim Herstellen der Internetverbindung. 19:42:53
- Serververbindung konnte nicht hergestellt werden..
Error - 21.05.2010 01:35:30 | Computer Name = Dietzschis-PC | Source = MCUpdate | ID = 0
Description = 07:35:30 - Fehler beim Herstellen der Internetverbindung. 07:35:30
- Serververbindung konnte nicht hergestellt werden..
Error - 21.05.2010 08:17:06 | Computer Name = Dietzschis-PC | Source = MCUpdate | ID = 0
Description = 14:16:12 - Fehler beim Herstellen der Internetverbindung. 14:16:12
- Serververbindung konnte nicht hergestellt werden..
Error - 22.05.2010 07:26:36 | Computer Name = Dietzschis-PC | Source = MCUpdate | ID = 0
Description = 13:26:35 - Fehler beim Herstellen der Internetverbindung. 13:26:36
- Serververbindung konnte nicht hergestellt werden..
Error - 22.05.2010 07:27:05 | Computer Name = Dietzschis-PC | Source = MCUpdate | ID = 0
Description = 13:26:42 - Fehler beim Herstellen der Internetverbindung. 13:26:42
- Serververbindung konnte nicht hergestellt werden..
Error - 23.05.2010 14:48:19 | Computer Name = Dietzschis-PC | Source = MCUpdate | ID = 0
Description = 20:48:16 - Fehler beim Herstellen der Internetverbindung. 20:48:18
- Serververbindung konnte nicht hergestellt werden..
[ System Events ]
Error - 07.06.2010 15:46:23 | Computer Name = Dietzschis-PC | Source = cdrom | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\CdRom0.
Error - 07.06.2010 15:46:31 | Computer Name = Dietzschis-PC | Source = cdrom | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\CdRom0.
Error - 07.06.2010 15:46:36 | Computer Name = Dietzschis-PC | Source = cdrom | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\CdRom0.
Error - 07.06.2010 15:46:46 | Computer Name = Dietzschis-PC | Source = cdrom | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\CdRom0.
Error - 07.06.2010 15:46:51 | Computer Name = Dietzschis-PC | Source = cdrom | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\CdRom0.
Error - 07.06.2010 21:47:34 | Computer Name = Dietzschis-PC | Source = atikmdag | ID = 43029
Description = Display is not active
Error - 08.06.2010 08:46:39 | Computer Name = Dietzschis-PC | Source = atikmdag | ID = 43029
Description = Display is not active
Error - 08.06.2010 12:31:45 | Computer Name = Dietzschis-PC | Source = atikmdag | ID = 43029
Description = Display is not active
Error - 08.06.2010 20:07:45 | Computer Name = Dietzschis-PC | Source = atikmdag | ID = 43029
Description = Display is not active
Error - 09.06.2010 13:55:50 | Computer Name = Dietzschis-PC | Source = atikmdag | ID = 43029
Description = Display is not active
< End of report >
|
|
13.06.2010, 14:29
| #5 |
| /// Malware-holic | AviraAntivir.bat - in C:\Users\...\AppData\Local\ - CPU überlastet, Virus oder nicht? Fixen mit OTL • Starte bitte die OTL.exe. Vista-User mit Rechtsklick "als Administrator starten" • Kopiere nun das Folgende in die Textbox. :OTL PRC - C:\Windows\SysWOW64\srvany.exe () :Files C:\Windows\SysWOW64\srvany.exe :Commands [purity] [EMPTYFLASH] [emptytemp] [start explorer] [Reboot] • Schliesse bitte nun alle Programme. • Klicke nun bitte auf den Run Fix Button. • OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen. • Nach dem Neustart findest Du ein Textdokument dieses posten |
|
13.06.2010, 14:49
| #6 |
| | AviraAntivir.bat - in C:\Users\...\AppData\Local\ - CPU überlastet, Virus oder nicht? Als Ausgabe kam: All processes killed ========== OTL ========== Process srvany.exe killed successfully! ========== FILES ========== C:\Windows\SysWOW64\srvany.exe moved successfully. ========== COMMANDS ========== [EMPTYFLASH] User: All Users User: Default User: Default User User: Dietzschis ->Flash cache emptied: 3293 bytes User: Public Total Flash Files Cleaned = 0,00 mb [EMPTYTEMP] User: All Users User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Dietzschis ->Temp folder emptied: 8401732 bytes ->Temporary Internet Files folder emptied: 1610360 bytes ->Java cache emptied: 2514754 bytes ->FireFox cache emptied: 35240917 bytes ->Google Chrome cache emptied: 350561452 bytes ->Flash cache emptied: 0 bytes User: Public %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32 (64bit) .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 1317432 bytes %systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33170 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 381,00 mb OTL by OldTimer - Version 3.2.6.0 log created on 06132010_154231 Files\Folders moved on Reboot... C:\Users\Dietzschis\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully. C:\Users\Dietzschis\AppData\Local\Temp\RtkBtMnt.exe moved successfully. File\Folder C:\Windows\temp\TMP0000000FC2F25EBCEEEF2CDD not found! File\Folder C:\Windows\temp\TMP000023CFC69643312C8C3C3F not found! Registry entries deleted on Reboot... +++ Microsofts Secrutiy Essentials hat eben kurz gemeldet, das der Virus irgendwas im Java Ordner ist. |
|
13.06.2010, 14:51
| #7 |
| /// Malware-holic | AviraAntivir.bat - in C:\Users\...\AppData\Local\ - CPU überlastet, Virus oder nicht? ok. download malwarebytes: Malwarebytes installieren, öffnen, registerkarte aktualisierung. danach registerkarte scanner, komplett scan, funde löschen, log posten. |
|
13.06.2010, 16:40
| #8 |
| | AviraAntivir.bat - in C:\Users\...\AppData\Local\ - CPU überlastet, Virus oder nicht? Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Datenbank Version: 4192 Windows 6.1.7600 Internet Explorer 8.0.7600.16385 13.06.2010 17:40:02 mbam-log-2010-06-13 (17-40-02).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|) Durchsuchte Objekte: 254081 Laufzeit: 1 Stunde(n), 6 Minute(n), 31 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 0 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: (Keine bösartigen Objekte gefunden) |
|
13.06.2010, 16:57
| #9 |
| /// Malware-holic | AviraAntivir.bat - in C:\Users\...\AppData\Local\ - CPU überlastet, Virus oder nicht? öffne mein computer (arbeitsplatz) dort c: dann suche den ordner _otl rechtsklick, zu _otl.rar oder zip hinzufügen. dann das archiv wie unter punkt2 beschrieben hochladen: http://www.trojaner-board.de/54791-a...ner-board.html gib bescheid, wenn das erledigt ist. |
|
13.06.2010, 17:20
| #10 |
| | AviraAntivir.bat - in C:\Users\...\AppData\Local\ - CPU überlastet, Virus oder nicht? Datei ist geuploadet. |
|
13.06.2010, 17:44
| #11 |
| /// Malware-holic | AviraAntivir.bat - in C:\Users\...\AppData\Local\ - CPU überlastet, Virus oder nicht? hat mse noch was angezeigt, wie läuft der pc im moment? avira avira so instalieren bzw. dann konfigurieren. wenn du die konfiguration übernommen hast, update das programm. klicke dann auf "lokaler schutz dann rechtsklick auf "lokale laufwerke" als admin scannen, funde in quarantäne, log posten. |
|
13.06.2010, 17:45
| #12 |
| | AviraAntivir.bat - in C:\Users\...\AppData\Local\ - CPU überlastet, Virus oder nicht? Also MSE meldet das nun kein Virus mehr vorhanden ist. Und die AviraAntivir.bat und das ist auch raus aus dem Autostart. Scheint wieder alles im Lot zu sein. |
|
13.06.2010, 17:50
| #13 |
| /// Malware-holic | AviraAntivir.bat - in C:\Users\...\AppData\Local\ - CPU überlastet, Virus oder nicht? mach den avira scan bitte wie beschrieben. hast du auch diese avira.bat gelöscht? |
|
| Themen zu AviraAntivir.bat - in C:\Users\...\AppData\Local\ - CPU überlastet, Virus oder nicht? |
| 100%, appdata, auslastung, avira antivir, cpu, cpu auslastung, cpu überlastet, datei, eingefangen, ergebnisse, essen, gen, google, interne, internet, leute, liste, melde, melden, namens, ordner, probleme, prozess, suche, system, virus, virus eingefangen |
Linear-Darstellung
